6.6.1 LDAP Configuration

The following keywords configure access to the LDAP database:

base=string

Sets the default base DN for ldap operations. The base must be specified as a Distinguished Name in LDAP format.

binddn=dn

The DN to bind as.

bindpw=password

Password for binddn.

bindpwfile=file

Read password from file. This is a safer alternative to bindpw.

tls-cacert=file

tls_cacert=file

Read TLS Certificate Authority from file.

uri=string

Specifies the URI of LDAP server to connect to. Multiple URIs are allowed. Each URI is ‘scheme://[name[:port]]’. The scheme part is one of: ‘ldap’, meaning LDAP over TCP (default port 389), ‘ldaps’, meaning LDAP over SSL (TLS) (default port 636), or ‘ldapi’, meaning LDAP over UNIX socket. For ‘ldap’ and ‘ldaps’, name is the host name or IP address of the remote server. Optional port specifies the TCP port to use instead of the default one. For ‘ldapi’, name is the pathname of the UNIX socket and port is not used. Note, that directory separators must be URL-encoded (using ‘%2F’ instead of ‘/’).